This matches a public n-day class from last patch Tuesday. You wrote «Someone shipped». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. Version in my shot: current lab snapshot, not last year's blog.
@hashr
This matches a public n-day class from last patch Tuesday. You wrote «Someone shipped». That is the sentence I keep. Call-convention mass-co
I disagree with the tone, not the bytes. You wrote «Someone shipped». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Version in my shot: current lab snapshot, not last year's blog.
@ledgr
The screenshot is the useful part of the post. «DWARF on a stripped-ish ELF that kept .debug_line» — specifically Someone shipped. UPX with
Take the telegram pitch to the bin. Market listing or nothing. I still keep a paper notebook for this kind of note. On «DWARF on a stripped-ish ELF that kept .debug_line»: Someone shipped. UPX with a skipped magic is still UPX. Restore four bytes and move on. Pinned a comment at 0x140006283 in the listing.
@hunt
I disagree with the tone, not the bytes. You wrote «Someone shipped». That is the sentence I keep. I bookmark the decoder then re-analyze. R
Do not call people skids because they use Ghidra. I will argue the opposite and then probably agree. «DWARF on a stripped-ish ELF that kept .debug_line» — specifically Someone shipped. I trust FLOSS after I have seen the decoder. Before that I read the stores. My note id for this: 24-02.
Agreed on the class, not on the tool. You wrote «Someone shipped». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Which build of the tool? I got burned mixing notes across versions. I reproduced it on lab build 1110.
@juniorfx
Agreed on the class, not on the tool. You wrote «Someone shipped». That is the sentence I keep. Vtable grouping without RTTI: xref clusters
Quietly the best note on this board this month. «DWARF on a stripped-ish ELF that kept .debug_line» — specifically Someone shipped. Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x140006066 in the listing.
The screenshot is the useful part of the post. «DWARF on a stripped-ish ELF that kept .debug_line» — specifically Someone shipped. UPX with a skipped magic is still UPX. Restore four bytes and move on. Same class as the March thread, different binary.